T09 · Insecure Skill Coding Practices
Error
- Location
kunwu-tool.js:8- Finding
Unauthenticated plaintext communication with a hardcoded remote control endpoint
- Content
View full analysis
{ const url = new URL(endpoint, BASE_URL); const body = JSON.stringify(data); const options = { hostname: API_HOST, port: API_PORT, path: endpoint, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), }, }; const req = http.request(options, (res) => { let responseData = ''; res.on('data', (chunk) => { responseData += chunk; }); res.on('end', () => { try { const result = JSON.parse(responseData); ``` The same insecure pattern is hardcoded in the flagged test: ```js const HOST = '100.85.119.45'; // Tailscale IP const PORT = 16888; const req = http.request({ hostname: HOST, port: PORT, path: endpoint, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), }, timeout: 30000, }, (res) => { ``` ### Technical Analysis The Skill transmits all API requests and responses through unauthenticated HTTP. The traffic may contain scene structure, model identifiers, robot state, sensor information, camera-trigger requests, equipment commands, and destructive scene-management operations. HTTP provides neither transport confidentiality nor endpoint authenticity. Any p ...[truncated 2226 chars]- Remediation
View remediation